cyber-risk-quant

What is a small business's cyber risk worth in dollars, and which missing control should it fix first to get insured and cut that risk? This tool turns a cyber-insurance application's control questions (MFA, backups, EDR, patching...) into a FAIR-style Monte Carlo loss model. It outputs a readiness score, a ranked gap list with each fix's dollar value, and an underwriter-ready Excel workbook.

Data honesty, up front. The three firms are hypothetical (no client data). Model inputs come from public sources: FBI IC3, NAIC, Verizon DBIR, Sophos, Coveware, Coalition, NetDiligence, Cyentia IRIS, Microsoft research, CISA KEV, NVD, HHS OCR, VCDB and Census CBP. Where no source exists, inputs are labelled assumptions with ranges. Of 80 parameters, 8 are taken directly from a source, 15 are derived from public data or published figures, and 57 are assumptions. Every one is listed with its basis in config/parameters.yaml and in each Excel workbook. The output is a decision aid, not a rate or a quote.

All numbers come from crq report (seed 20261010, 100,000 simulated years per posture). Two full runs produced identical output.

Findings worth discussing:

1. Knock-outs and expected loss are different questions. For the dental clinic, the three knock-out fixes cost an illustrative ~$10K a year and cut expected loss by ~$1.2K. On ALE alone they don't pay, and only phishing training (1.03x) beats its own cost. Their value is insurability (whether the risk gets quoted at all) and the tail: TVaR99 falls from $258K, about 8% of revenue, to $148K.
2. The best fix depends on the loss mix. Ransomware is 75% of the clinic's expected loss and 85% of the manufacturer's, so EDR (which acts after entry on every route) leads. The law firm's largest component is BEC/wire fraud (41%), so a $500 payment call-back procedure is its best fix.
3. Patching windows are shorter than most SLAs. Of 832 CVEs published since 2022 that CISA lists as exploited, 27% were listed on or before their publication day, 50% within 7 days, 65% within 30 (CISA KEV + NVD, computed here).
4. VaR95 is $0 for every firm, because fewer than 5% of years have any loss. Rare-event risk needs exceedance probabilities and TVaR, which the tool reports instead.

flowchart LR
    subgraph Public data
      A1[NAIC claims / policies] --> F
      A2[Coalition claim mix] --> F
      A3[Sophos / DBIR attack vectors] --> V
      A4[CISA KEV + NVD dates] --> P[Patch-SLA curve]
      A5[Sophos recovery times, IC3, DBIR, Coveware, IRIS] --> M
      A6[HHS OCR, VCDB, Census CBP] --> VAL[Validation]
    end
    Q[Underwriting questionnaire<br/>15 questions, 3 knock-outs] --> S[Readiness score + tier]
    Q --> C[Control posture 0-1]
    P --> C
    C --> V[Relative vulnerability<br/>by attack vector]
    F[LEF anchor<br/>claims per policy-year] --> L[Loss Event Frequency]
    V --> L
    L --> MC((Monte Carlo<br/>100k years, CRN))
    M[Loss Magnitude<br/>BI, response, ransom, funds, breach] --> MC
    MC --> O1[ALE, LEC, TVaR]
    MC --> O2[Insured loss: retention, sublimits, aggregate] --> O3[Indicated premium]
    MC --> O4[Gap values + tornado]
    O1 & O3 & O4 & S --> X[Excel workbook / Streamlit UI / case studies]

• FAIR decomposition: risk = Loss Event Frequency x Loss Magnitude, both distributions. Frequency is anchored on insurance claims per policy-year (NAIC 2023-2024) split by Coalition's claim mix. It is then scaled by firm size, industry and relative vulnerability: each control reduces only the attack vectors it blocks (Sophos/DBIR initial-access shares), with effect sizes sampled from cited ranges.
• Magnitude is built from components: business interruption from a recovery-time curve fitted to Sophos survey data, response, restoration, ransom (pay probability tied to backup quality), BEC transfers (DBIR median + IC3 mean), and breach notification, regulatory and litigation costs.
• Common random numbers (inverse-CDF Poisson, per-event-slot random streams) make "fix one control" comparisons exact. The tests check that every simulated year is at least as cheap after any single improvement.
• Two-dimensional Monte Carlo separates parameter uncertainty (the 90% ALE interval) from year-to-year randomness.
• Full specification: docs/METHODOLOGY.md. Teaching walkthrough: docs/INTERVIEW_GUIDE.md.

python -m venv .venv && source .venv/bin/activate      # Windows: .venv\Scripts\activate
pip install -r requirements-dev.txt && pip install -e .
crq run profiles/dental_clinic.yaml --xlsx dental.xlsx  # ALE, tail metrics, gap list, underwriter workbook
streamlit run app/streamlit_app.py                       # interactive questionnaire + LEC
pytest                                                   # 40 tests

To rebuild everything from raw public data: crq data download && crq calibrate && crq report (about 7 minutes). Other commands: crq assess <profile> (score only), crq validate, crq params (every parameter with its source). Sample workbooks are in examples/. A read-only Docker setup for the UI is in deploy/.

Raw data is downloaded by crq data download into data/raw/ (git-ignored, about 200 MB). Only small derived tables are committed. HHS rows are committed without entity names.

• No firm-level loss data. No public dataset links an SMB's controls to its losses. Control effects come from vector shares times effect-size ranges, and are checked against Marsh's observational findings, not measured.
• Frequency anchor. Claims per policy-year mixes all insured sizes and claim types. The HHS comparison suggests it may overstate reportable breaches for small healthcare practices (~26x). A carrier would substitute its own class frequency.
• Most parameters (57 of 80) are judgement. They are ranges, and the tornado charts show which ones matter. Business-interruption assumptions and the frequency anchor dominate.
• Single risk, independent scenarios. No systemic/cloud aggregation, no contingent BI, no OT-specific modelling, U.S. regulatory context only.
• Premium is a loss-cost indication. Real premiums depend on filed rates, minimum premiums and the market cycle. No verified public SMB premium data was found to compare against.
• Questionnaire weights reflect underwriting emphasis in broker and carrier publications, not a fitted model.

1. Replace the frequency anchor with state attorney-general breach-portal data (it has denominators outside healthcare) to test the HHS gap more broadly.
2. Add an EPSS-weighted patch curve (prioritise by exploit probability, not only by SLA) and model edge devices separately, since KEV's top vendors are VPN and firewall makers.
3. Correlated scenarios (one intrusion leading to both ransomware and BEC) and a portfolio view (many SMBs, shared MSP or cloud dependency) for accumulation risk.
4. Bayesian updating of the control effects once any claims-with-attestations data is available.

Ali Askari. As an IT intern at a small IT services firm, I helped SMB clients gather control evidence (MFA status, backup posture, EDR coverage) for cyber-insurance renewal applications. This project is the quantitative version of that work, built entirely on public data and hypothetical firms. MIT licence.